scriptoriumadmin/GitNexus
1
0
Fork 0
mirror of https://github.com/abhigyanpatwari/GitNexus.git synced 2026-10-07 02:58:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8
1833 commits 117 branches 1040 tags 252 MiB
Commit graph

208 commits

Author SHA1 Message Date
ChunxueLi
d2f768245e fix(routes): address round-2 review — provider hooks, FQN fold, interface nesting 
F1 (High): production harvest silently dropped routes when the constants
class is not named *Constants (e.g. ApiPaths). The content gate is now
SYNTAX-driven (static-final String field or any class import) and lives in
the provider (moduleConstantHeuristic), not a shared-layer regex.

F2: shared ingestion layers no longer branch on language. The harvest and
the qualified-ref fold run through new provider hooks
(extractModuleConstants / foldRoutePathOperands); parse-impl resolves the
provider by filePath (getProviderForFile). Python wires the same hooks for
architecture parity.

F3: multi-segment FQN chains (com.example.ApiPaths.USERS) now flatten
recursively; verified via tree-sitter that the existing query already
captures the whole nested field_access — the gap was resolver-side only.

F4: implicit-final interface semantics no longer leak into nested classes
at type boundaries (JLS 9.5).

F5: nested same-name shadowing now drops the stale entry (rebind-drop,
matching Python #2391 semantics) instead of keeping the first binding.

Tests: 9 new unit tests (27/27) + real-pipeline e2e over a reviewer-shaped
fixture (non-*Constants class, cold run + warm parse-cache replay) — the
exact production gap unit tests missed.
 2026-08-21 01:19:49 +08:00
nerdCopter
aac7515d2a
fix(deps): override sharp >=0.35.0 to remediate libvips vulnerabilities (#2993)
Some checks failed
CodeQL / Analyze (javascript-typescript) (push) Has been cancelled
Details
CodeQL / Analyze (python) (push) Has been cancelled
Details
Gitleaks / gitleaks (push) Has been cancelled
Details
Publish / Classify release event (push) Has been cancelled
Details
Scorecard / Scorecard analysis (push) Has been cancelled
Details
Trivy Image Scan / Trivy (gitnexus-cli) (push) Has been cancelled
Details
Trivy Image Scan / Trivy (gitnexus-web) (push) Has been cancelled
Details
Publish / RC guard (marker + release-PR skip) (push) Has been cancelled
Details
Publish / ci (push) Has been cancelled
Details
Publish / Publish to npm (push) Has been cancelled
Details
Publish / Build & Push RC Docker images (push) Has been cancelled
Details
2026-08-19 07:21:32 -07:00
nerdCopter
e4b8a48042
fix(deps): override adm-zip >=0.6.0 to remediate memory allocation vulnerability (#2992) 
Remediates GHSA-xcpc-8h2w-3j85 (DoS via crafted ZIP file 4GB memory allocation in onnxruntime-node).

Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
 2026-08-19 04:22:42 +00:00
dependabot[bot]
c75c29047d
chore(deps)(deps-dev): bump @types/node in /gitnexus (#2971) 
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.1.2 to 26.2.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-15 09:17:39 +01:00
dependabot[bot]
ac5626b160
chore(deps)(deps-dev): bump tsx from 4.23.11 to 4.23.12 in /gitnexus (#2958) 
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.23.11 to 4.23.12.
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.11...v4.23.12)

---
updated-dependencies:
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-14 07:52:01 +01:00
dependabot[bot]
6d2c2f68ee
chore(deps)(deps-dev): bump tsx from 4.23.5 to 4.23.11 in /gitnexus (#2925) 
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.23.5 to 4.23.11.
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.5...v4.23.11)

---
updated-dependencies:
- dependency-name: tsx
  dependency-version: 4.23.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-11 11:48:00 +00:00
dependabot[bot]
d3687259d0
chore(deps)(deps): bump @ladybugdb/core in /gitnexus (#2924) 
Bumps [@ladybugdb/core](https://github.com/LadybugDB/ladybug) from 0.19.0 to 0.19.1.
- [Release notes](https://github.com/LadybugDB/ladybug/releases)
- [Commits](https://github.com/LadybugDB/ladybug/compare/v0.19.0...v0.19.1)

---
updated-dependencies:
- dependency-name: "@ladybugdb/core"
  dependency-version: 0.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
 2026-08-11 12:25:21 +01:00
dependabot[bot]
49f34e128a
chore(deps)(deps-dev): bump tsx from 4.23.4 to 4.23.5 in /gitnexus (#2862) 
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.23.4 to 4.23.5.
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.4...v4.23.5)

---
updated-dependencies:
- dependency-name: tsx
  dependency-version: 4.23.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
 2026-08-08 08:17:11 +01:00
dependabot[bot]
e91ea0ca85
chore(deps)(deps): bump @ladybugdb/core in /gitnexus (#2863) 
Bumps [@ladybugdb/core](https://github.com/LadybugDB/ladybug) from 0.18.3 to 0.19.0.
- [Release notes](https://github.com/LadybugDB/ladybug/releases)
- [Commits](https://github.com/LadybugDB/ladybug/compare/v0.18.3...v0.19.0)

---
updated-dependencies:
- dependency-name: "@ladybugdb/core"
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
 2026-08-08 08:17:00 +01:00
dependabot[bot]
cdf6793277
chore(deps)(deps): bump express-rate-limit in /gitnexus (#2876) 
Bumps [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) from 8.6.1 to 8.6.2.
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](https://github.com/express-rate-limit/express-rate-limit/compare/v8.6.1...v8.6.2)

---
updated-dependencies:
- dependency-name: express-rate-limit
  dependency-version: 8.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-08 08:16:09 +01:00
dependabot[bot]
60d244b726
chore(deps)(deps-dev): bump tsx from 4.23.1 to 4.23.4 in /gitnexus (#2850) 
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.23.1 to 4.23.4.
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.4)

---
updated-dependencies:
- dependency-name: tsx
  dependency-version: 4.23.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-06 08:19:46 +01:00
Shifra Williams
a6a8aa788c
feat(serve): validate and port-scope the origin/proxy configuration surface (#2820) 2026-08-05 06:52:39 +01:00
dependabot[bot]
f36c3eb678
chore(deps)(deps): bump js-yaml from 5.2.2 to 5.2.3 in /gitnexus (#2831)
Some checks are pending
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Details
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
Details
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
Details
CodeQL / Analyze (python) (push) Waiting to run
Details
Gitleaks / gitleaks (push) Waiting to run
Details
Publish / Classify release event (push) Waiting to run
Details
Publish / RC guard (marker + release-PR skip) (push) Blocked by required conditions
Details
Publish / ci (push) Blocked by required conditions
Details
Publish / Publish to npm (push) Blocked by required conditions
Details
Publish / Build & Push RC Docker images (push) Blocked by required conditions
Details
Scorecard / Scorecard analysis (push) Waiting to run
Details 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.2.2 to 5.2.3.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/5.2.2...5.2.3)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 21:16:34 +00:00
dependabot[bot]
b2cd1c2ad6
chore(deps)(deps): bump @hono/node-server in /gitnexus (#2827) 
Bumps [@hono/node-server](https://github.com/honojs/node-server) from 1.19.14 to 2.1.0.
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](https://github.com/honojs/node-server/compare/v1.19.14...v2.1.0)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 11:29:51 +01:00
dependabot[bot]
f3b4806389
chore(deps)(deps): bump fast-uri from 3.1.4 to 3.1.5 in /gitnexus (#2821) 
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
 2026-08-04 08:53:24 +00:00
dependabot[bot]
e7503b6ea5
chore(deps)(deps): bump @modelcontextprotocol/sdk in /gitnexus (#2815) 
Bumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) from 1.29.0 to 1.30.0.
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
 2026-08-04 09:33:12 +01:00
dependabot[bot]
4c0a78fcfb
chore(deps)(deps): bump hono from 4.12.31 to 4.13.0 in /gitnexus (#2822) 
Bumps [hono](https://github.com/honojs/hono) from 4.12.31 to 4.13.0.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.31...v4.13.0)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 08:23:53 +01:00
dependabot[bot]
38be4c6bd2
chore(deps)(deps): bump node-addon-api from 8.9.0 to 8.9.1 in /gitnexus (#2816) 2026-08-04 06:48:55 +00:00
dependabot[bot]
ca294e8cdb
chore(deps)(deps): bump ip-address from 10.2.0 to 10.4.0 in /gitnexus (#2818) 2026-08-04 07:24:37 +01:00
dependabot[bot]
a6aae8142d
chore(deps)(deps): bump brace-expansion from 5.0.7 to 5.0.9 in /gitnexus (#2786) 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.7 to 5.0.9.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.7...v5.0.9)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-01 18:00:21 +00:00
dependabot[bot]
d99d828a52
chore(deps)(deps): bump express-rate-limit in /gitnexus (#2764) 
Bumps [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) from 8.6.0 to 8.6.1.
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](https://github.com/express-rate-limit/express-rate-limit/compare/v8.6.0...v8.6.1)

---
updated-dependencies:
- dependency-name: express-rate-limit
  dependency-version: 8.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
 2026-07-31 10:42:37 +01:00
dependabot[bot]
59ea1ce2c8
chore(deps)(deps-dev): bump @types/node in /gitnexus (#2763) 
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.1.1 to 26.1.2.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-31 07:58:11 +01:00
Abhigyan Patwari
652ef6842e
Merge pull request #2712 from abhigyanpatwari/dependabot/npm_and_yarn/gitnexus/tar-7.5.22 
chore(deps)(deps): bump tar from 7.5.20 to 7.5.22 in /gitnexus
 2026-07-27 14:09:07 +05:30
Abhigyan Patwari
fbeb2be470
Merge pull request #2711 from abhigyanpatwari/dependabot/npm_and_yarn/gitnexus/postcss-8.5.23 
chore(deps)(deps-dev): bump postcss from 8.5.16 to 8.5.23 in /gitnexus
 2026-07-27 14:08:55 +05:30
dependabot[bot]
1e9f74dc58
chore(deps)(deps): bump js-yaml from 5.0.0 to 5.2.2 in /gitnexus (#2710) 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.0.0 to 5.2.2.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/5.0.0...5.2.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.2.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-27 09:38:37 +01:00
dependabot[bot]
32160e8cd7
chore(deps)(deps): bump tar from 7.5.20 to 7.5.22 in /gitnexus 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.20 to 7.5.22.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.20...v7.5.22)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-27 06:53:55 +00:00
dependabot[bot]
84e33f5048
chore(deps)(deps-dev): bump postcss from 8.5.16 to 8.5.23 in /gitnexus 
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.16 to 8.5.23.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.16...8.5.23)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-27 06:53:38 +00:00
dependabot[bot]
e34967eed5
chore(deps)(deps): bump express-rate-limit in /gitnexus (#2657) 
Bumps [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) from 8.5.2 to 8.6.0.
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](https://github.com/express-rate-limit/express-rate-limit/compare/v8.5.2...v8.6.0)

---
updated-dependencies:
- dependency-name: express-rate-limit
  dependency-version: 8.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-24 06:48:07 +01:00
Gergő Magyar
e814e28f1f
fix(deps): bump @ladybugdb/core to ^0.18.3 — rel-property IN-predicate fix (#2508) (#2634) 
LadybugDB ≤0.18.2 mis-evaluated `r.type IN [...]` on relationship table
groups: the boolean-filter fallback skipped writing selection buffers for
single-row unflat chunks, dropping/duplicating callers in context() and
impact() (upstream LadybugDB#692, fixed by LadybugDB#699, shipped in
0.18.3). Floor the dependency at ^0.18.3 and lock core + all five platform
packages.

Resurrect the caller-identity regression test from PR #2553 (closed as
superseded by the upstream fix): it pins context()/impact() to exact
caller IDs across CodeRelation sub-table pairs so any future predicate
regression fails loudly. Note: with CREATE-seeded data the test also
passes on 0.18.2 (the upstream repro needs COPY-written chunk layouts) —
it is a behavioural pin, not a bug reproduction.

Fixes #2508

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-07-22 16:31:56 +01:00
dependabot[bot]
735289e399
chore(deps)(deps): bump fast-uri from 3.1.2 to 3.1.4 in /gitnexus (#2626) 
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 08:27:11 +01:00
dependabot[bot]
c35403b59d
chore(deps)(deps): bump js-yaml from 4.3.0 to 5.0.0 in /gitnexus (#2618) 
* chore(deps)(deps): bump js-yaml from 4.3.0 to 5.0.0 in /gitnexus

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 5.0.0.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.3.0...5.0.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(spring-config): migrate YAML parsing to js-yaml 5 event API

js-yaml 5 removed the loadAll `listener` callback, the EventType/State
types, and DEFAULT_SCHEMA that spring-config relied on, breaking the build.

Rebuild the per-key line tree from parseEvents()/constructFromEvents()
(positions are source offsets → mapped to lines), apply the `<<` merge tag
via CORE_SCHEMA.withTags(mergeTag) (CORE alone leaves merge keys unexpanded),
and resolve aliases by anchor name, which lets the object-identity WeakMap go.

Behavior preserved: 9 unit + 8 integration spring-config tests pass, including
merged-key declaration-line, cyclic-alias termination, and the depth budget.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(spring-config): restore v4 tag coverage, cover the v5 rewrite with tests

Review follow-up for #2618.

CORE_SCHEMA.withTags(mergeTag) was a narrowing, not a port: js-yaml 5
throws "unknown tag" on !!timestamp/!!binary/!!set/!!omap/!!pairs, and an
unknown tag aborts the whole parse, which readConfigKeys swallows — so an
application.yml using any of them would have gone from its full key set to
zero keys, silently. Carry the rest of what DEFAULT_SCHEMA was; none of
these tags can execute code.

Add tests for every path the review flagged as uncovered: multi-document
files, empty/comment-only/bare-`---`/bare-scalar documents, sequence-form
merge keys, and explicitly tagged values (which fail against the one-tag
schema, so they target the changed line).

Clear the anchor map per document. It cannot change output today —
constructFromEvents rejects a cross-document alias before the event tree is
built, now asserted — but it keeps both layers on YAML's scoping rule.

Drop the stale @types/js-yaml devDependency; js-yaml 5 ships its own types
and tsc --noEmit is clean without it. Lockfile hand-edited because npm
uninstall also strips every libc field.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(autofix): apply prettier + eslint fixes via /autofix command

* fix(spring-config): flatten !!set members, walk YAML iteratively

Review follow-up for #2618.

js-yaml 5 constructs `!!set` as a native Set; v4 built a plain
`{member: null}` object. Object.entries of a Set is empty, so a tagged set
collapsed to a bare leaf key and lost every member. Enumerate the Set
instead. Sets arrive as mapping events with key/value scalar pairs, so
member lines resolve through the usual lookup. !!binary and !!timestamp are
unaffected — both are scalar events and take the leaf path, which is why a
Uint8Array never explodes into one key per byte.

Convert findYamlMappingLocation and flattenYamlValue from recursion to an
explicit stack. Children are pushed in reverse so pops happen in
declaration order, preserving "first match" and `out` insertion order;
`leave` frames release the cycle guard where the old `finally` did. The
depth budget still throws at the same boundary with the same message.

Cover the gaps the review named: !!pairs (both duplicate entries survive),
anchor-name reuse resolving to the nearest preceding declaration, and
marker-only leading documents staying index-aligned across the two streams.

buildYamlEventTree keeps no node budget by design — one node per event over
an already-materialized array, bounded by MAX_CONFIG_FILE_BYTES. The
docstring now says so rather than implying MAX_YAML_TRAVERSAL_NODES covers
it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Gergő Magyar <gergomagyar@icloud.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 2026-07-22 07:50:51 +01:00
dependabot[bot]
50b0f2f775
chore(deps)(deps): bump hono from 4.12.26 to 4.12.31 in /gitnexus (#2619) 
Bumps [hono](https://github.com/honojs/hono) from 4.12.26 to 4.12.31.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.26...v4.12.31)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.31
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 22:42:44 +01:00
dependabot[bot]
2d4e24811e
chore(deps)(deps-dev): bump @types/node in /gitnexus (#2617) 
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.0.0 to 26.1.1.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 21:58:44 +01:00
Claude
c26b78d153 fix(deps)!: require Node >=22.18 and drop @types/uuid stub 
Babel 8 (devDep for the bench mutation oracle, pulled in by dependabot
previous floor (>=22.0.0), so every dev install on Node <22.18 emitted
nine EBADENGINE warnings. Rather than pin Babel back to 7, adopt Node
22.18+ as the supported minimum: set engines to ^22.18.0 || >=24.11.0,
matching Babel 8 exactly so the warnings resolve honestly with no
dependabot ignore needed.

@types/uuid@11 is a deprecated stub - uuid@14 ships its own types and no
tsconfig references it. Lockfile edited by hand (engines + @types/uuid
entry) to preserve the libc platform metadata a newer npm wrote;
verified consistent via npm ci (exit 0).

BREAKING CHANGE: the gitnexus package now requires Node ^22.18.0 || >=24.11.0
(previously >=22.0.0). Node 22.0-22.17 are no longer supported.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-21 10:09:30 +00:00
Gergő Magyar
10545a52f0
Merge branch 'main' into dependabot/npm_and_yarn/gitnexus/ladybugdb/core-0.18.2 2026-07-21 08:40:14 +01:00
dependabot[bot]
b028cc0212
chore(deps)(deps): bump body-parser from 2.2.2 to 2.3.0 in /gitnexus (#2594) 
Bumps [body-parser](https://github.com/expressjs/body-parser) from 2.2.2 to 2.3.0.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 08:05:49 +01:00
dependabot[bot]
cdd0ce9b8e
chore(deps)(deps): bump brace-expansion from 5.0.6 to 5.0.7 in /gitnexus (#2593) 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.6 to 5.0.7.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.6...v5.0.7)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 08:05:33 +01:00
dependabot[bot]
7c22975048
chore(deps)(deps): bump tar from 7.5.16 to 7.5.20 in /gitnexus 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.16 to 7.5.20.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.16...v7.5.20)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.20
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-21 06:13:22 +00:00
Gergő Magyar
cdeb9b59a5
Merge branch 'main' into dependabot/npm_and_yarn/gitnexus/ladybugdb/core-0.18.2 2026-07-21 07:10:13 +01:00
Gergő Magyar
281664eb0a
Revert "chore(deps)(deps): bump js-yaml from 4.3.0 to 5.0.0 in /gitnexus (#2586)" (#2596) 
This reverts commit 3f93bf22d6.
 2026-07-21 07:08:37 +01:00
Gergő Magyar
2c4e0af64a
Merge branch 'main' into dependabot/npm_and_yarn/gitnexus/ladybugdb/core-0.18.2 2026-07-21 05:45:04 +01:00
dependabot[bot]
5935921079
chore(deps)(deps-dev): bump @types/node in /gitnexus (#2588) 
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.9.5 to 26.0.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 05:44:37 +01:00
dependabot[bot]
3f93bf22d6
chore(deps)(deps): bump js-yaml from 4.3.0 to 5.0.0 in /gitnexus (#2586) 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 5.0.0.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.3.0...5.0.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-21 05:44:25 +01:00
dependabot[bot]
9c87030edf
chore(deps)(deps): bump @ladybugdb/core in /gitnexus 
Bumps [@ladybugdb/core](https://github.com/LadybugDB/ladybug) from 0.18.1 to 0.18.2.
- [Release notes](https://github.com/LadybugDB/ladybug/releases)
- [Commits](https://github.com/LadybugDB/ladybug/compare/v0.18.1...v0.18.2)

---
updated-dependencies:
- dependency-name: "@ladybugdb/core"
  dependency-version: 0.18.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 20:15:31 +00:00
dependabot[bot]
22905bb2a7
chore(deps)(deps-dev): bump @babel/traverse in /gitnexus (#2532) 
Bumps [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) from 8.0.0 to 8.0.4.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.4/packages/babel-traverse)

---
updated-dependencies:
- dependency-name: "@babel/traverse"
  dependency-version: 8.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-17 13:24:01 +01:00
dependabot[bot]
0b777979d8
chore(deps)(deps-dev): bump @babel/types in /gitnexus (#2534) 
Bumps [@babel/types](https://github.com/babel/babel/tree/HEAD/packages/babel-types) from 8.0.0 to 8.0.4.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.4/packages/babel-types)

---
updated-dependencies:
- dependency-name: "@babel/types"
  dependency-version: 8.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-17 13:23:47 +01:00
dependabot[bot]
527ea5fc7a
chore(deps)(deps-dev): bump @babel/types in /gitnexus (#2518) 2026-07-17 05:26:54 +01:00
dependabot[bot]
e8fdc2e2ab
chore(deps)(deps-dev): bump @babel/generator in /gitnexus (#2519) 2026-07-17 04:42:39 +01:00
dependabot[bot]
91955e6576
chore(deps)(deps-dev): bump @babel/traverse in /gitnexus (#2520)
Some checks are pending
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
Details
CodeQL / Analyze (python) (push) Waiting to run
Details
Gitleaks / gitleaks (push) Waiting to run
Details
Publish / Classify release event (push) Waiting to run
Details
Publish / RC guard (marker + release-PR skip) (push) Blocked by required conditions
Details
Publish / ci (push) Blocked by required conditions
Details
Publish / Publish to npm (push) Blocked by required conditions
Details
Publish / Build & Push RC Docker images (push) Blocked by required conditions
Details
Scorecard / Scorecard analysis (push) Waiting to run
Details
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Details
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run
Details 
Bumps [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) from 7.29.7 to 8.0.0.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.0/packages/babel-traverse)

---
updated-dependencies:
- dependency-name: "@babel/traverse"
  dependency-version: 8.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-16 22:51:51 +01:00
dependabot[bot]
795f81127b
chore(deps)(deps-dev): bump tsx from 4.23.0 to 4.23.1 in /gitnexus (#2517) 
Bumps [tsx](https://github.com/privatenumber/tsx) from 4.23.0 to 4.23.1.
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.0...v4.23.1)

---
updated-dependencies:
- dependency-name: tsx
  dependency-version: 4.23.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-16 21:54:48 +01:00